Can a Medical Website Use a Chatbot? HIPAA Compliant Chat ExplainedWhen a chat widget becomes a HIPAA matter, which vendors sign a BAA, and how to set one up safely.

Yes, a medical website can use a chatbot. If the chat can receive patient information, the chat vendor must sign a Business Associate Agreement (BAA). The practice must also turn off the features that the BAA does not cover. This guide explains when HIPAA applies to chat, which vendors document a BAA, and how to set a chat tool up.

HIPAA compliant chat at a glance

• A chat box is an open text field. Patients will type symptoms, names, and insurance details into it.
• A vendor that stores those messages is a business associate and needs a BAA.
• LiveChat and Zendesk both document a BAA. Each requires specific plans and settings.
• An AI chatbot needs a BAA with the AI model provider as well as the chat platform.

When does a website chat fall under HIPAA?

A website chat falls under HIPAA when a covered entity's chat tool receives information that identifies a person and relates to their health or care. HHS defines a business associate as a person or entity that performs functions for a covered entity "that involve access by the business associate to protected health information." A chat vendor that stores patient messages fits that definition.

A practice cannot control what a visitor types. A patient who is asked "How can we help?" may answer with a diagnosis and a date of birth. Plan for that from the first day.

Which chat vendors sign a BAA?

We checked two widely used chat vendors' own help pages on October 9, 2026. Both sign a BAA. Both attach conditions.

Both vendors exclude add-ons. Zendesk states that Marketplace apps, third-party services, and integrations such as social media channels are not covered and should not be used with patient information. LiveChat tells customers to audit every installed app and remove the ones that do not comply.

Can a medical website use an AI chatbot?

Yes, with two BAAs. An AI chatbot sends each visitor message to an AI model. The company that runs the model is a second vendor. OpenAI lists its API with Modified Retention as HIPAA-eligible. Anthropic covers HIPAA-ready API organizations under its BAA. An API account without the vendor's BAA and required configuration is not covered. Our comparison of HIPAA compliant AI tools lists the covered version of each.

Ask a chatbot vendor these three questions in writing:

1. Will you sign a BAA with our practice?
2. Which AI model provider do you use, and do you hold a BAA with it?
3. Are our chat messages used to train any model?

How do you set up a chat tool safely?

1. 1

   Sign the BAA first

   Do not install the widget on the live site until the BAA is signed. Save a dated copy.

2. 2

   Turn off transcripts by email

   Stop the tool from emailing chat transcripts to visitors or staff inboxes that are not under a BAA.

3. 3

   Turn off file sharing

   Patients will upload insurance cards and photos if the tool allows it. Disable uploads unless the BAA covers them.

4. 4

   Remove unapproved integrations

   Disconnect social media channels and marketplace apps that the vendor's BAA does not cover.

5. 5

   Lock down staff access

   Give each agent a separate login. Turn on 2-step verification.

6. 6

   Add a first message

   Open each chat with a line that tells visitors not to share emergencies in chat and to call 911 for one.

How Webpatch helps

Webpatch is a technology company that works with healthcare practices. We build websites and manage their security, HIPAA compliance, SEO, and AEO. We are not a law firm, and this is not legal advice. If you want a chat tool reviewed before it goes live, contact Webpatch.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.